package com.example.config;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import java.io.IOException;
import java.io.OutputStream;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;

import com.example.util.Response;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;
import org.springframework.util.StreamUtils;

@Component
@WebFilter(
        urlPatterns = {"/ser/*,/sys/*"},
        filterName = "SQLInjection"
)
public class SqlInjectFilter implements Filter {
    private Logger logger = LoggerFactory.getLogger(this.getClass().getName());
    private static Pattern pattern = Pattern.compile("\\b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)\\b|(\\*\\+|'|%)");

    public SqlInjectFilter() {
    }

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        Map parametersMap = ((ServletRequest)servletRequest).getParameterMap();
        Iterator it = parametersMap.entrySet().iterator();

        String str;
        while(it.hasNext()) {
            Map.Entry entry = (Map.Entry)it.next();
            String[] value = (String[])((String[])entry.getValue());
            Object key = entry.getKey();

            for(int i = 0; i < value.length; ++i) {
                str = value[i];
                if (null != str && containsSqlInjection(str) && !key.equals("token")) {
                    String msg = "非法参数" + key + "=" + value[i] + "!";
                    this.logger.error(msg);
                    this.action((ServletRequest)servletRequest, servletResponse, msg);
                    return;
                }
            }
        }

        if (servletRequest instanceof HttpServletRequest) {
            ChangeRequestWrapper changeRequestWrapper = new ChangeRequestWrapper((HttpServletRequest)servletRequest);
            byte[] requestBody = StreamUtils.copyToByteArray(((ServletRequest)servletRequest).getInputStream());
            JSONObject jsonObject = JSON.parseObject(new String(requestBody, "UTF-8"));
            if (jsonObject != null) {
                Iterator var18 = jsonObject.keySet().iterator();

                while(var18.hasNext()) {
                    str = (String)var18.next();
                    Object v = jsonObject.get(str);
                    if (null != v && containsSqlInjection(v.toString()) && !str.equals("token")) {
                        String msg = "非法参数" + str + "=" + v + "!";
                        this.logger.error(msg);

                        try {
                            this.action((ServletRequest)servletRequest, servletResponse, msg);
                        } catch (IOException var14) {
                            var14.printStackTrace();
                        }

                        return;
                    }
                }
            }

            servletRequest = changeRequestWrapper;
        }

        filterChain.doFilter((ServletRequest)servletRequest, servletResponse);
    }

    private static boolean containsSqlInjection(Object obj) {
        Matcher matcher = pattern.matcher(obj.toString());
        return matcher.find();
    }

    private void action(ServletRequest servletRequest, ServletResponse servletResponse, String msg) throws IOException {
        servletResponse.setContentType("application/json; charset=utf-8");
        servletResponse.setCharacterEncoding("UTF-8");
        Map<String, Object> map = new HashMap(2);
        map.put("flag", false);
        map.put("message", "您输入的参数存在安全隐患!" + msg);
        Response selfResponse = new Response(map);
        OutputStream out = servletResponse.getOutputStream();
        JSONObject json = (JSONObject)JSON.toJSON(selfResponse);
        out.write(json.toJSONString().getBytes("UTF-8"));
        out.flush();
    }
}
